New sub-processor: Userpilot

Privacy Q&A: Userpilot in TOPdesk

What is Userpilot?
Userpilot is a tool that allows TOPdesk to show in-product guidance — things like onboarding walkthroughs, tooltips, and short feedback prompts — directly inside the TOPdesk interface. It is used by TOPdesk to help customers get more value from the product.

Does Userpilot have access to our data?
No. Userpilot does not have access to anything stored in your TOPdesk environment. It cannot see your tickets, your customer records, your personal data, or any content your organisation has entered into TOPdesk.

What data does Userpilot collect?
Userpilot processes only:

Interaction metadata — whether a user engaged with, dismissed, or completed a guidance element (e.g. a walkthrough or tooltip).
User metadata — a limited set of identifiers that TOPdesk sends so the same guidance isn't shown repeatedly to the same user.

This data is pseudonymous: it does not include names, email addresses, or any content from your TOPdesk environment. Because it involves limited user identifiers, it is treated as personal data under the GDPR and handled accordingly.

Where is the data stored and processed?
All data processed by Userpilot in connection with TOPdesk is stored and processed within the European Union — specifically on servers located in France — for all customers, regardless of where the customer is located. To deliver the guidance correctly, Userpilot uses IP addresses to determine the end user's country; these IP addresses are not stored permanently and are discarded once processed.

Is Userpilot a subprocessor under our data processing agreement with TOPdesk?
Yes. Userpilot has been added as a subprocessor. Customers are informed of this through a separate, formal subprocessor notification (published on our SaaS status page), which sets out the required details and your right to object within the stated period. This Q&A is a reference document and is not itself that formal notification.

Is there a Data Processing Agreement (DPA) in place with Userpilot?
Yes, a Data Processing Agreement is in place between TOPdesk and Userpilot. The agreement itself is confidential between the parties, so we are not able to share a copy — but we are happy to answer questions about how your data is processed and protected.

Can we opt out, or ask for our data to be deleted?
Under the GDPR (Article 17, the "right to erasure"), individuals can ask for their personal data to be deleted — for example, when it is no longer necessary or consent has been withdrawn. To exercise this right, contact us at the address below and we will handle the request. This is separate from your right to object to the addition of Userpilot as a subprocessor, which is covered by the formal subprocessor notification procedure and related objection period.

Who can we contact with further questions?

For general questions or remarks about this change, please reach out to TOPdesk Support: support@topdesk.com or https://my.topdesk.com. For questions specifically about privacy or data protection, you can contact our privacy team directly at privacy@topdesk.com.

TOPdesk is introducing in-product guidance within the TOPdesk interface — short walkthroughs, tooltips, and occasional feedback prompts that help users discover features and get more value from TOPdesk. This guidance is delivered through a platform provided by Userpilot, Inc..

Please note that, unlike optional add-on products, this guidance layer applies to all TOPdesk SaaS environments; it is not a separate subscription.

What does this change mean for your data?

To deliver this guidance, Userpilot processes a limited set of data on TOPdesk's behalf:

Interaction metadata — whether a guidance element was seen, completed, dismissed, or skipped.

A limited set of user identifiers — used so the same guidance isn't shown repeatedly to the same user.

This data is pseudonymous. It does not include any content from your TOPdesk environment — no tickets, no customer records, and no personal data you have entered into TOPdesk. Because Userpilot processes limited personal data (user identifiers) on TOPdesk's behalf, Userpilot acts as a sub-processor as defined under applicable data protection laws, including the GDPR, the UK GDPR, and the Brazilian General Data Protection Law (LGPD).

The data processed by Userpilot in connection with TOPdesk is stored and processed within the European Union — specifically on servers located in France — for all customers, regardless of where the customer is located. It is accessible only to authorised personnel.

For customers located outside the EU, this means your Userpilot-related data is processed in the EU rather than in your own region. To deliver the guidance correctly, Userpilot uses IP addresses to determine the end user's country; these IP addresses are not stored permanently and are discarded once processed. This data is encrypted in transit and at rest and is covered by a Data Processing Agreement that provides appropriate safeguards in accordance with applicable data protection law.

This change takes effect on 21st of August.

For more details and background information, see My TOPdesk Knowledge Item: KI 19347

Should you have any objections regarding this change, please reply within 30 days to TOPdesk Support: support@topdesk.com or https://my.topdesk.com. Our support team is also available for any other questions or remarks regarding this change.